79 matches found
PT-2023-20148 · Bumsys · Bumsys
Name of the Vulnerable Software and Affected Versions: bumsys versions prior to 2.2.0 Description: The issue concerns external control of file name or path in the GitHub repository unilogies/bumsys. Recommendations: For versions prior to 2.2.0, update to version 2.2.0 or later to resolve the issu...
CVE-2023-2551
CVE-2023-2551 affects the PHP-based Bumsys (unilogies/bumsys) with versions prior to 2.1.1. The vulnerability stems from an API endpoint that processes file paths and allows local files to be included, enabling remote code execution via crafted requests to the api route. The root cause is unsafe ...
CVE-2023-2552 Cross-Site Request Forgery (CSRF) in unilogies/bumsys
Cross-Site Request Forgery CSRF in GitHub repository unilogies/bumsys prior to 2.1.1...
CVE-2023-2554 External Control of File Name or Path in unilogies/bumsys
External Control of File Name or Path in GitHub repository unilogies/bumsys prior to 2.2.0...
CVE-2023-2553 Cross-site Scripting (XSS) - Stored in unilogies/bumsys
Cross-site Scripting XSS - Stored in GitHub repository unilogies/bumsys prior to 2.2.0...
bumsys 安全漏洞
bumsys is an open source project called Business Management System by unilogies individual developers. A security vulnerability exists in versions of bumsys prior to 2.1.1, which stems from an api processing endpoint that is allowed to contain local files that can be used to cause remote code...
CVE-2023-2551 PHP Remote File Inclusion in unilogies/bumsys
PHP Remote File Inclusion in GitHub repository unilogies/bumsys prior to 2.1.1...
CVE-2023-2551 PHP Remote File Inclusion in unilogies/bumsys
PHP Remote File Inclusion in GitHub repository unilogies/bumsys prior to 2.1.1...
CVE-2023-2554 External Control of File Name or Path in unilogies/bumsys
External Control of File Name or Path in GitHub repository unilogies/bumsys prior to 2.2.0...
CVE-2023-2553 Cross-site Scripting (XSS) - Stored in unilogies/bumsys
Cross-site Scripting XSS - Stored in GitHub repository unilogies/bumsys prior to 2.2.0...
PT-2023-20140 · Unilogies · Bumsys
Name of the Vulnerable Software and Affected Versions: unilogies/bumsys versions prior to 2.2.0 Description: The issue is related to Cross-site Scripting XSS - Stored, which occurs when an application receives input from a user and stores it, allowing an attacker to inject malicious scripts. This...
bumsys 跨站脚本漏洞
bumsys is an open source project called Business Management System by unilogies individual developers. A cross-site scripting vulnerability exists in versions of bumsys prior to 2.2.0, which stems from a stored cross-site scripting XSS vulnerability...
bumsys 跨站请求伪造漏洞
bumsys is an open source project called Business Management System by the individual developers of unilogies. A cross-site request forgery vulnerability exists in versions of unilogies/bumsys prior to 2.1.1, which stems from the presence of cross-site request forgery...
CVE-2023-1361
SQL Injection in GitHub repository unilogies/bumsys prior to v2.0.2...
Sql injection
SQL Injection in GitHub repository unilogies/bumsys prior to v2.0.2...
CVE-2023-1362 Improper Restriction of Rendered UI Layers or Frames in unilogies/bumsys
Improper Restriction of Rendered UI Layers or Frames in GitHub repository unilogies/bumsys prior to v2.0.2...
CVE-2023-1361
CVE-2023-1361 : SQL Injection in the open-source project unilogies/bumsys prior to v2.0.2. The vulnerability stems from core/ajax/ajax_data.php where customer_id is sanitized but interpolated into an unquoted numeric context, allowing injected SQL (example PoC in Huntr shows a time-based sleep). ...
PT-2023-16928 · Unilogies · Bumsys
Name of the Vulnerable Software and Affected Versions: unilogies/bumsys versions prior to 2.0.2 Description: The issue is related to SQL Injection. Recommendations: For versions prior to 2.0.2, update to version 2.0.2 or later to resolve the issue...
bumsys SQL注入漏洞
bumsys is an open source project called Business Management System by unilogies individual developers. unilogies bumsys version before v2.0.2 has a SQL injection vulnerability , the vulnerability stems from core/ajax/ajaxdata.php in the SQL injection...